When attempting to provision or update a link block inside an azurerm_vpn_site using the module the reordering or changing of the list will cause Terraform to attempt to reprovision all link blocks which changes the order for the index operation for subsequent azurerm_vpn_gateway_connection usage.
Remediation
Changing the variable and resource configuration for the vpn_sites links from a list to a map will provide stable identifiers for usage and prevent unnecessary churn and misconfiguration by index mismatch on the vpn_site_connections variable
variable "vpn_sites" {
type = map(object({
name = string
# Name of the virtual hub
virtual_hub_name = string
links = map(object({ <--- changed to a map from a list
name = string
bgp = optional(object({
asn = number
peering_address = string
}))
fqdn = optional(string)
ip_address = optional(string)
provider_name = optional(string)
speed_in_mbps = optional(number)
}
))
address_cidrs = optional(list(string))
device_model = optional(string)
device_vendor = optional(string)
o365_policy = optional(object({
traffic_category = object({
allow_endpoint_enabled = optional(bool)
default_endpoint_enabled = optional(bool)
optimize_endpoint_enabled = optional(bool)
})
}))
tags = optional(map(string))
}))
description = "S2S VPN Sites parameter"
default = {}
}
Summary
When attempting to provision or update a link block inside an azurerm_vpn_site using the module the reordering or changing of the list will cause Terraform to attempt to reprovision all link blocks which changes the order for the index operation for subsequent azurerm_vpn_gateway_connection usage.
Remediation
Changing the variable and resource configuration for the vpn_sites links from a list to a map will provide stable identifiers for usage and prevent unnecessary churn and misconfiguration by index mismatch on the vpn_site_connections variable